CVE-2026-111911
Deferred Deferred - Pending Action

Authentication Bypass via WebAuthn in phpMyFAQ

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111911
EUVD
EUVD-2026-103309

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
thorsten phpMyFAQ 4.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-111911 is a critical authentication bypass vulnerability in phpMyFAQ versions 4.0.0 through 4.1.8. It allows attackers to register WebAuthn credentials on any account without authentication or challenge validation by submitting a forged attestation with fmt=none. This enables full account takeover, bypassing passwords and TOTP.

Detection Guidance

To detect this vulnerability, check if your phpMyFAQ instance is running a vulnerable version (4.0.0 through 4.1.8). Inspect network logs for suspicious requests to /api/webauthn/prepare endpoints with known usernames. Look for unauthorized WebAuthn credential registrations in the webauthnkeys field of user accounts.

Impact Analysis

Attackers can take over any account, including administrator accounts, by registering their own passkey. This allows unauthorized access to sensitive data, system control, and bypasses multi-factor authentication. The attack requires only knowledge of a username and network access.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA compliance requirements for data protection and access controls. Organizations using affected phpMyFAQ versions may face regulatory penalties and reputational damage.

Mitigation Strategies

Immediately upgrade phpMyFAQ to version 4.1.9 or later. Ensure WebAuthn registration endpoints validate account ownership and server challenges. Disable WebAuthn registration for existing accounts until patched. Monitor for unauthorized credential additions to user accounts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111911. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart